Instructions on Business Controls for Credit Information Companies

This document has been translated for knowledge purposes only, but for legal purposes, the Arabic version is adopted. Number: 28/1/20487 Date: 27/5/1444 Hijri Corresponding to 21/12/2022 Instructions on Business Controls for Credit Information Companies no (13/ 2022). Issued pursuant to the Provisions of Article (32/ B) of the Temporary Credit Information Law no (15) of the Year (2010). Article (1): Application scope. These instructions shall be called the “Instructions on Business Controls for Credit Information Companies” which shall apply to the entities below to the extent applicable to each, and shall be enforced as of 1/4/ 2023: A. Credit information companies. B. Data providers. C. Credit providers. Article (2): Definitions. A. Wherever they appear in these instructions, the following words and expressions should have the meanings assigned to them hereunder unless the context indicates otherwise: Law : The Temporary Credit Information Law no (15) of the Year (2010). Bylaw : The Bylaw of Credit Information Companies no (36) of the Year (2011). Central Bank : The Central Bank of Jordan. Company : The credit information company licensed to exercise the activities determined by the provisions of the Law and the Bylaw. Board : The Company's Board of Directors or Management Committee. Credit record : The record set by the company, containing all credit information of the person, which are collected from multiple resources and upon which the credit report is prepared. Bounced check : Any check withdrawn on any bank that is not cashed for lack of or insufficient coverage whether in the Jordanian Dinar or foreign currencies. B. The words and expressions mentioned in these instructions shall have the meanings assigned to them in the Law and Bylaw unless the context indicates otherwise.

This document has been translated for knowledge purposes only, but for legal purposes, the Arabic version is adopted. Article (3): Retaining credit information and any information related to the credit status of the client in the company's database and credit report. A. The following information and data shall be shown in the credit report as per the periods set for each:

1. Information related to inquiries about the client in terms of number of inquiries and number of inquiring entities: (2) years as of the date of inquiry.
2. Information related to the client’s failure to meet their obligations on time, which includes delay and/ or default on payments: (3) years as of the date of payment of each installment or cancellation of the client’s debt.
3. Information related to paid credit balances: (3) years prior to the date of inquiry concerning the pattern of payment.
4. Information related to bounced checks: (3) years as of the date of settlement of the check or (5) years as of the date of its bouncing, when it is not settled, whichever comes earlier.
5. Information related to the content and outcome of the objections submitted by the client with concern to any information mentioned in the credit report, which were rejected by the data provider: (3) years as of the date of adjudicating the objection.
6. Information related to the write-off of the debts: (5) years as of the date of write￾off of the debt, whether partially or fully, or (3) years as of the date of payment of the debt or cancellation of the client’s debt in any form, whichever comes earlier.
7. Information related to final judicial verdicts related to the credit status of clients: (5) years as of the date of issuance of relevant verdicts, or (3) years as of the date of payment of the credit balance or cancellation of the clients' debt in any form, whichever comes earlier.
8. Information related to the insolvency or bankruptcy of the client: (7) years as of the date of verdict’s issuance. B. The company must retain credit information including the above mentioned information on its database for a period of (10) years as of the date of termination of the contractual relationship between the client and the credit provider. C. The company must retain a record for all inquiries conducted on the credit report of the clients, where the record shows the date of each inquiry and inquiring entity. In case the inquiry process shows unavailability, then a record containing the date of inquiry, information used in inquiring on the client and the inquiring entity shall be maintained. Article (4): Safety and protection of the database. Subject to what the Bylaw stated, the company shall regulate the access of credit providers to its database taking into consideration the following: A. That the procedure of accessing the company's database is conducted safely, where appropriate passwords are used and periodically changed. B. Conducting periodical review for the controls of the passwords of the company's employees and credit providers.

This document has been translated for knowledge purposes only, but for legal purposes, the Arabic version is adopted. C. Periodical monitoring for the patterns of handling credit reports to detect any unusual usage. D. Retaining automated review reports for all access requests on the database and amendments conducted on credit records. Article (5): Credit providers and data providers. Not withstanding what is mentioned in article (16) of the Bylaw, the following shall be obligated: A. Prior to conducting agreements with credit providers to regulate the access to any of the services it provides, the company shall exercise due diligence to ensure the eligibility of the credit providers for obtaining any of these services. B. The company should re-verify the eligibility of the credit provider upon renewing the agreement concluded with them, or in case the company has reservations on the way the credit provider uses credit reports, or whenever needed. C. The data provider must provide the company with updated data on a weekly basis. D. Banks shall provide the company with bounced checks data on a daily basis. E. The data provider must provide the company with updated data on a daily basis if this data contains significant changes on the credit information of the client which includes the following cases:

1. If the submitted data is inaccurate or incorrect.
2. In case of the client’s default.
3. If the client settles their full financial obligation.
4. If the client obtains any new credit. F. Data providers and credit providers must take into consideration the rights of clients stated in article (6) of these instructions as well as the confidentiality of their data and their protection of any unauthorized usage during exchange or updating of credit information or use of any of their credit reports. G. The data provider may not include the name of the guarantor in their client’s credit information or provide with the guarantor credit information unless the prior written approval of the guarantor is obtained. H. The credit provider may not enable others to view information and data obtained from the company whether through disclosure, sale or transfer. I. The credit provider subject to the supervision of the Central Bank shall inquire via the company on any client before granting or renewing credit to them. J. The credit provider cannot conduct any changes or amendments to credit report items that are issued by the company. K. The credit provider must hold an access permit issued by the client for a period no less than the contract term, unless a dispute or complaint is filed regarding the relevant credit and/ or information and data shown on the credit report of the client, where the access permit is held until the dispute is resolved or a final verdict is issued in that regard.

This document has been translated for knowledge purposes only, but for legal purposes, the Arabic version is adopted. Article (6): Clients’ rights Further to what is mentioned in the Law and Bylaw, the client is entitled to the following: A. Identify the entity that inquired on his/ her credit report for the (2) years prior to the date of requesting the report. B. File an objection with the company should the report contain false information, in case the report is not updated or in case the inquiry on his/ her credit report is made without legitimate purpose, or any other cases that require objection. Article (7): Disputing the accuracy of credit information Notwithstanding what is stated in articles (17) and (18) of the Bylaw, the following is obligatory: A. The company must prepare an approved policy that clarifies procedures to be taken in resolving received objections. B. Disputing the same credit report is filed once. In case the client wishes to submit a second objection, a new credit report should be requested before submitting the objection. C. In case the data provider confirms the accuracy of the credit information in question, and the client continues with their objection, the client is consequently entitled to state the reasons for his/ her disapproval in writing and in brief which shall be kept in the credit report of the client. D. In case the inaccuracy of information in question is due to the company, then the company must report to the Central Bank all relevant details. E. The company must notify the clients that their objections are being addressed. F. The company must hold a record of all objections submitted by clients regarding their credit information as well as of the taken procedures and their results, for a period of no less than (5) years as of the date of addressing the objection. G. The data provider is liable for any mistake or inaccuracy in information and data provided to the company. Article (8): General provisions A. The company must comply with the following:

1. Submitting the financial statements audited by its chartered accountant to the Central Bank in a period not exceeding two months as of the end of the fiscal year.
2. Obtaining prior written approval of the Central Bank before opening branches.
3. Notifying the Central Bank of any breach of its technical systems and the procedures taken in that regard.
4. Preparing a record that includes the names, activities and addresses of data providers as well as contracts and agreements conducted with them.
5. Setting a code of conduct approved by the Board, which includes clear principles, policies, controls for the business conduct and professional ethics. The company should take all necessary actions to verify the abidance of the Board, executive management, and all workers in the company with this code. Moreover, a copy of the mentioned code should be provided to the Central Bank.

This document has been translated for knowledge purposes only, but for legal purposes, the Arabic version is adopted. B. The following should be provided to the Central Bank:

1. Quarterly report regarding providing data and inquiry about clients, on the individual and sectoral levels of the data providers.
2. An annual report of complaints and objections received by the company.
3. Any data or information requested per the determined time and form.